1. Configuring and Troubleshooting Routing and Remote Access

2. Module Overview Configuring Network Access Configuring VPN Access
Overview of Network Policies
Overview of the Connection Manager Administration Kit
Troubleshooting Routing and Remote Access 2

3. Configuring Network Access
Components of a Network Access Services Infrastructure
What Is the Network Policy and Access Services Role?
What Is Routing and Remote Access?
Network Authentication and Authorization
Types of Authentication Methods
Integrating DHCP Servers with Routing and Remote Access Service

4. Components of a Network Access Services Infrastructure
Intranet
Internet
NAP Health Policy Server
DHCP Server
Health Registration Authority
IEEE 802.1X Devices
Active Directory
VPN Server
Restricted Network
Perimeter Network
Remediation Servers
Network Policy Server

5. What Is the Network Policy and Access Services Role?
Enforce health policies
Help to secure wireless and wired access
Enable remote access solutions
Centralize network policy management

6. What Is Routing and Remote Access?
Used to provide remote users access to resources on a private network over Dial-up or VPN services
Can be used to provide NAT services
Can provide LAN and WAN routing services to connect network segments

7. Network Authentication and Authorization
Verifies the credentials of a connection attempt
Uses an authentication protocol to send the credentials from the remote access client to the remote access server in either plain text or encrypted form
Authorization:
Verifies that the connection attempt is allowed
Occurs after successful authentication

8. Types of Authentication Methods
Protocol
Description
Security Level
PAP
Uses plaintext passwords. Typically used if the remote access client and remote access server cannot negotiate a more secure form of validation.
The least secure authentication protocol. Does not protect against replay attacks, remote client impersonation, or remote server impersonation.
CHAP
A challenge-response authentication protocol that uses the industry- standard MD5 hashing scheme to encrypt the response.
An improvement over PAP in that the password is not sent over the PPP link.
Requires a plaintext version of the password to validate the challenge response. Does not protect against remote server impersonation.
MS-CHAPv2
An upgrade of MS-CHAP. Two-way authentication, also known as mutual authentication, is provided. The remote access client receives verification that the remote access server that it is dialing in to has access to the user’s password.
Provides stronger security than CHAP.
EAP
Allows for arbitrary authentication of a remote access connection through the use of authentication schemes, known as EAP types.
Offers the strongest security by providing the most flexibility in authentication variations.

9. Integrating DHCP Servers with Routing and Remote Access Service
You can provide remote clients with IP configurations by using either:
A static pool created on the Routing and Remote Access server for use with remote clients
The corporate DHCP server that is located on the corporate LAN
DHCP servers that run Windows Server 2008 R2:
Provide a predefined user class called the Default Routing and Remote Access Class
Are useful for assigning options that are provided to Routing and Remote Access clients only

10. Configuring VPN Access
What Is a VPN Connection?
Tunneling Protocols for a VPN Connection
What Is VPN Reconnect?
Configuration Requirements
Completing Additional Tasks

11. What Is a VPN Connection?
Corporate Headquarters
Large Branch Office
Small Branch Office
VPN Server
VPN Server
VPN Server
Medium Branch Office
VPN
Home Office with VPN Client
VPN Server
Remote User with VPN Client

12. Tunneling Protocols for a VPN Connection
Windows Server 2008 supports four VPN tunneling protocols:
PPTP
L2TP/IPsec
SSTP
IKEv2

13. What Is VPN Reconnect?
The VPN Reconnect feature maintains connectivity across network outages. It requires Windows Server 2008 R2 or Windows 7.
VPN Reconnect:
Provides seamless and consistent VPN connectivity
Uses the Internet Key Encryption version 2 (IKEv2) technology
Automatically re-establishes VPN connections when connectivity is available
Maintains the connection if users move between different networks
Makes the connection status transparent to users

14. Configuration Requirements
VPN server configuration requirements include:
Two network interfaces (public and private)
IP Address allocation (static pool or DHCP)
Authentication provider (NPS/Radius or the VPN server)
DHCP relay agent considerations
Membership in the Local Administrators group or equivalent

15. Completing Additional Tasks
Configure static packet filters ü
Configure services and ports ü
Adjust logging levels for routing protocols ü
Configure number of available VPN ports ü
Create a Connection Manager profile for users ü
Add Certificate Services ü
Increase remote access security ü
Increase VPN security ü
Consider implementing VPN Reconnect ü

16. Overview of Network Policies
What Is a Network Policy?
Process for Creating and Configuring a Network Policy
How Are Network Policies Processed?

17. What Is a Network Policy?
A network policy consists of the following elements:
Conditions
Constraints
Settings

18. Process for Creating and Configuring a Network Policy
Determine authorization by user or group ü
Determine appropriate settings for the user account’s network access permissions ü
Configure the New Network Policy Wizard:
Configure Network Policy conditions
Configure Network Policy constraints
Configure Network Policy settings ü

19. How Are Network Policies Processed?
START
Yes No
Go to next policy
Are there policies to process?
Does connection attempt match policy conditions? No
Yes
Yes
Is the remote access permission for the user account set to Deny Access? No
Reject connection attempt No
Yes
Is the remote access permission for the user account set to Allow Access?
Reject connection attempt
Is the remote access permission on the policy set to Deny remote access permission?
Yes No
Yes
Accept connection attempt No
Does the connection attempt match the user object and profile settings?

20. Overview of the Connection Manager Administration Kit
What Is the Connection Manager Administration Kit?
Process for Configuring a Connection Profile
Distributing the Connection Profile to Users

21. What Is the Connection Manager Administration Kit?
Allows you to customize users’ remote connection experience by creating predefined connections on remote servers and networks
Creates an executable file that can be run on a client computer to establish a network connection that you have designed
Reduces Help Desk requests related to the configuration of RAS connections
Assists in problem resolution because the configuration is known
Reduces the likelihood of user errors when they configure their own connection objects

22. Process for Configuring a Connection Profile
The CMAK Connection Profile Wizard assists in the process of creating custom connection profiles for users
Use the CMAK Connection Profile Wizard to configure:
The target operating system
Support for VPN
Support for Dial-up, including the custom phone book
Proxy
Custom Help file
Custom support information

23. Distributing the Connection Profile to Users
The connection profile can be distributed to users in the following ways:
As part of an image for new computers
On removable media for the user to install manually
With software distribution tools, such as Systems Management Server or System Center Configuration Manager 2007

24. Troubleshooting Routing and Remote Access
Authentication and Accounting Logging
Configuring Remote Access Logging
Configuring Remote Access Tracing
Resolving General VPN Problems
Troubleshooting Other Issues

25. Authentication and Accounting Logging
There are three types of logging for Network Policy Server:
Event logging for auditing and troubleshooting connection attempts
Logging authentication and accounting requests to a local file
Logging authentication and accounting requests to a SQL server database

26. Configuring Remote Access Logging
You can configure remote access logging to:
Log errors only
Log errors and warnings
Log all events
Not log any events
Log additional routing and remote access information

27. Configuring Remote Access Tracing
You can configure remote access tracing by using:
The Netsh command:
Netsh ras diagnostics set rastracing * enabled (enables tracing on all components in RAS)
The Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
Tracing consumes resources, so you should use it for troubleshooting only and then disable it

28. Resolving General VPN Problems

29. Troubleshooting Other Issues
Common problems regarding remote access include:
Error 800: VPN unreachable
Error 721: Remote computer not responding
Error 741/742: Encryption mismatch
L2TP/IPsec issues
EAP-TLS issues

30. Summary Configuring Network Access Configuring VPN Access
Overview of Network Policies
Overview of the Connection Manager Administration Kit
Troubleshooting Routing and Remote Access 30